CISM Domain 2 · Information Security Risk Management
- Domain
- CISM Domain 2 · Information Security Risk Management
- Exam
- CISM
- Exam weight
- 20%
- What it covers
The emerging threat landscape, vulnerability and control deficiency analysis, risk assessment, treatment options, risk and control ownership, and monitoring and reporting.
- What the exam rewards
- Risk assessed in business terms
- Owners making documented treatment decisions
- KRIs with thresholds
- Reporting against appetite
- Common traps
- Security accepting risk for the business
- Prioritizing by technical severity alone
- Treating a risk register as a one-off document
- Official subtopics
Information Security Risk Assessment
- Emerging Risk and Threat Landscape
- Vulnerability and Control Deficiency Analysis
- Risk Assessment and Analysis
Information Security Risk Response
- Risk Treatment / Risk Response Options
- Risk and Control Ownership
- Risk Monitoring and Reporting
- How to study it
Master the four responses (accept, avoid, mitigate, transfer or share) and the ALE formula, then practice ownership questions.